CVE-2024-1520: OS Command Injection in parisneo/lollms-webui
First published: Wed Apr 10 2024(Updated: )
An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to unauthorized command execution on the underlying operating system. This could result in unauthorized access, data leakage, or complete system compromise.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| parisneo lollms |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1520?
CVE-2024-1520 has a high severity rating due to its potential for enabling OS Command Injection attacks.
How can I fix CVE-2024-1520?
To fix CVE-2024-1520, you need to implement proper input validation for the 'discussion_id' parameter in the '/open_code_folder' endpoint.
What systems are affected by CVE-2024-1520?
CVE-2024-1520 affects the parisneo lollms-webui application, specifically targeting its '/open_code_folder' endpoint.
What kind of attack can exploit CVE-2024-1520?
CVE-2024-1520 can be exploited by attackers using OS Command Injection to execute arbitrary commands on the server.
Is there a known workaround for CVE-2024-1520?
Currently, the best workaround for CVE-2024-1520 is to avoid using the vulnerable '/open_code_folder' endpoint until a patch is applied.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/parisneo
- canonical/parisneo lollms